<!doctype html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Nginx 访问控制列表 (ACL) 完全指南</title>
    <link rel="stylesheet" href="https://cdn.staticfile.org/font-awesome/6.4.0/css/all.min.css">
    <link rel="stylesheet" href="https://cdn.staticfile.org/tailwindcss/2.2.19/tailwind.min.css">
    <link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@400;500;600;700&family=Noto+Sans+SC:wght@300;400;500;700&display=swap" rel="stylesheet">
    <script src="https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.min.js"></script>
    <style>
        body {
            font-family: 'Noto Sans SC', Tahoma, Arial, Roboto, "Droid Sans", "Helvetica Neue", "Droid Sans Fallback", "Heiti SC", "Hiragino Sans GB", Simsun, sans-serif;
            background: linear-gradient(135deg, #f5f7fa 0%, #c3cfe2 100%);
            min-height: 100vh;
        }
        
        .hero-gradient {
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
        }
        
        .card-hover {
            transition: all 0.3s ease;
            border: 1px solid transparent;
        }
        
        .card-hover:hover {
            transform: translateY(-5px);
            box-shadow: 0 20px 40px rgba(0,0,0,0.1);
            border-color: #667eea;
        }
        
        .code-block {
            background: #1e1e1e;
            border-radius: 12px;
            overflow: hidden;
            position: relative;
        }
        
        .code-header {
            background: #2d2d2d;
            padding: 10px 20px;
            font-size: 12px;
            color: #888;
            display: flex;
            justify-content: space-between;
            align-items: center;
        }
        
        pre {
            margin: 0;
            padding: 20px;
            overflow-x: auto;
        }
        
        pre code {
            color: #f8f8f2;
            font-family: 'Consolas', 'Monaco', monospace;
            font-size: 14px;
            line-height: 1.6;
        }
        
        .section-title {
            position: relative;
            display: inline-block;
            margin-bottom: 2rem;
        }
        
        .section-title::after {
            content: '';
            position: absolute;
            bottom: -10px;
            left: 0;
            width: 60px;
            height: 4px;
            background: linear-gradient(90deg, #667eea, #764ba2);
            border-radius: 2px;
        }
        
        .feature-icon {
            width: 60px;
            height: 60px;
            background: linear-gradient(135deg, #667eea, #764ba2);
            border-radius: 16px;
            display: flex;
            align-items: center;
            justify-content: center;
            color: white;
            font-size: 24px;
            margin-bottom: 1rem;
        }
        
        .mermaid {
            background: white;
            padding: 2rem;
            border-radius: 12px;
            box-shadow: 0 10px 30px rgba(0,0,0,0.1);
        }
        
        .copy-btn {
            background: #667eea;
            color: white;
            padding: 6px 12px;
            border-radius: 6px;
            font-size: 12px;
            cursor: pointer;
            transition: all 0.3s ease;
        }
        
        .copy-btn:hover {
            background: #764ba2;
        }
        
        .highlight-box {
            background: linear-gradient(135deg, #f093fb 0%, #f5576c 100%);
            color: white;
            padding: 1.5rem;
            border-radius: 12px;
            margin: 2rem 0;
        }
        
        .first-letter {
            float: left;
            font-size: 4rem;
            line-height: 3rem;
            padding-right: 0.5rem;
            font-weight: 700;
            color: #667eea;
            font-family: 'Noto Serif SC', serif;
        }
    </style>
</head>
<body>
    <!-- Hero Section -->
    <div class="hero-gradient text-white">
        <div class="container mx-auto px-6 py-20">
            <div class="max-w-4xl mx-auto text-center">
                <h1 class="text-5xl md:text-6xl font-bold mb-6 leading-tight">
                    Nginx 访问控制列表
                    <span class="block text-3xl md:text-4xl mt-2 opacity-90">完全配置指南</span>
                </h1>
                <p class="text-xl md:text-2xl opacity-90 leading-relaxed">
                    掌握 Nginx ACL 配置，精准控制服务器访问权限
                </p>
                <div class="mt-8 flex justify-center space-x-4">
                    <div class="bg-white bg-opacity-20 rounded-lg px-6 py-3">
                        <i class="fas fa-shield-alt mr-2"></i>安全防护
                    </div>
                    <div class="bg-white bg-opacity-20 rounded-lg px-6 py-3">
                        <i class="fas fa-network-wired mr-2"></i>IP 控制
                    </div>
                    <div class="bg-white bg-opacity-20 rounded-lg px-6 py-3">
                        <i class="fas fa-cog mr-2"></i>灵活配置
                    </div>
                </div>
            </div>
        </div>
    </div>

    <!-- Main Content -->
    <div class="container mx-auto px-6 py-12">
        <div class="max-w-6xl mx-auto">
            
            <!-- Introduction -->
            <div class="bg-white rounded-2xl shadow-xl p-8 mb-8 card-hover">
                <p class="text-lg leading-relaxed text-gray-700">
                    <span class="first-letter">在</span> Nginx 中，访问控制列表（ACL）用于限制哪些客户端可以访问你的服务器或特定的资源。可以通过配置 <code class="bg-purple-100 text-purple-800 px-2 py-1 rounded">allow</code> 和 <code class="bg-purple-100 text-purple-800 px-2 py-1 rounded">deny</code> 指令来实现。这些指令通常用于限制 IP 地址访问。
                </p>
            </div>

            <!-- ACL Concept Visualization -->
            <div class="mb-12">
                <h2 class="section-title text-3xl font-bold text-gray-800 mb-8">ACL 工作原理</h2>
                <div class="mermaid">
                    graph LR
                        A[客户端请求] --> B{IP 地址检查}
                        B -->|匹配 Allow 规则| C[允许访问]
                        B -->|匹配 Deny 规则| D[拒绝访问]
                        B -->|无匹配规则| E[默认策略]
                        C --> F[返回资源]
                        D --> G[返回 403]
                        E -->|Deny All| G
                        E -->|Allow All| F
                        
                        style A fill:#f9f,stroke:#333,stroke-width:2px
                        style C fill:#9f9,stroke:#333,stroke-width:2px
                        style D fill:#f99,stroke:#333,stroke-width:2px
                        style F fill:#9ff,stroke:#333,stroke-width:2px
                        style G fill:#faa,stroke:#333,stroke-width:2px
                </div>
            </div>

            <!-- Basic Configuration Section -->
            <section class="mb-12">
                <h2 class="section-title text-3xl font-bold text-gray-800">基本配置</h2>
                
                <!-- Configuration Cards -->
                <div class="grid md:grid-cols-2 gap-6 mt-8">
                    <!-- Card 1 -->
                    <div class="bg-white rounded-2xl shadow-lg p-6 card-hover">
                        <div class="feature-icon">
                            <i class="fas fa-lock"></i>
                        </div>
                        <h3 class="text-xl font-bold text-gray-800 mb-3">1. 允许和拒绝 IP 地址</h3>
                        <p class="text-gray-600 mb-4">配置特定 IP 地址或网段的访问权限</p>
                        <div class="code-block">
                            <div class="code-header">
                                <span>nginx.conf</span>
                                <button class="copy-btn" onclick="copyCode(this)">
                                    <i class="fas fa-copy mr-1"></i>复制
                                </button>
                            </div>
                            <pre><code>server {
    listen 80;
    server_name demo.com;

    location / {
        # 允许特定 IP 访问
        allow 192.168.1.1;
        allow 192.168.1.0/24;

        # 拒绝其他 IP 访问
        deny all;

        # 其他配置
        root /usr/share/nginx/html;
        index index.html;
    }
}</code></pre>
                        </div>
                        <div class="mt-4 space-y-2">
                            <p class="text-sm text-gray-600"><i class="fas fa-check-circle text-green-500 mr-2"></i><code class="bg-gray-100 px-2 py-1 rounded text-sm">allow</code> 指令用于允许特定的 IP 地址或网络访问</p>
                            <p class="text-sm text-gray-600"><i class="fas fa-times-circle text-red-500 mr-2"></i><code class="bg-gray-100 px-2 py-1 rounded text-sm">deny</code> 指令用于拒绝特定的 IP 地址或网络访问</p>
                        </div>
                    </div>

                    <!-- Card 2 -->
                    <div class="bg-white rounded-2xl shadow-lg p-6 card-hover">
                        <div class="feature-icon">
                            <i class="fas fa-network-wired"></i>
                        </div>
                        <h3 class="text-xl font-bold text-gray-800 mb-3">2. 多个 IP 地址和网络</h3>
                        <p class="text-gray-600 mb-4">配置多个 IP 地址和网段的复杂访问规则</p>
                        <div class="code-block">
                            <div class="code-header">
                                <span>nginx.conf</span>
                                <button class="copy-btn" onclick="copyCode(this)">
                                    <i class="fas fa-copy mr-1"></i>复制
                                </button>
                            </div>
                            <pre><code>server {
    listen 80;
    server_name demo.com;

    location / {
        # 允许指定的 IP 地址和网络访问
        allow 192.168.1.100;
        allow 10.0.0.0/8;

        # 拒绝所有其他 IP 地址
        deny all;

        # 其他配置
        root /usr/share/nginx/html;
        index index.html;
    }
}</code></pre>
                        </div>
                    </div>
                </div>

                <!-- Card 3 -->
                <div class="bg-white rounded-2xl shadow-lg p-6 card-hover mt-6">
                    <div class="feature-icon">
                        <i class="fas fa-folder-open"></i>
                    </div>
                    <h3 class="text-xl font-bold text-gray-800 mb-3">3. 特定路径的访问控制</h3>
                    <p class="text-gray-600 mb-4">为不同的 URL 路径设置独立的访问控制规则</p>
                    <div class="code-block">
                        <div class="code-header">
                            <span>nginx.conf</span>
                            <button class="copy-btn" onclick="copyCode(this)">
                                <i class="fas fa-copy mr-1"></i>复制
                            </button>
                        </div>
                        <pre><code>server {
    listen 80;
    server_name demo.com;

    location /admin {
        # 允许指定的 IP 地址访问 /admin 路径
        allow 192.168.1.0/24;

        # 拒绝其他 IP 地址访问 /admin 路径
        deny all;

        # 其他配置
        root /usr/share/nginx/html;
        index index.html;
    }
}</code></pre>
                    </div>
                </div>
            </section>

            <!-- Advanced Configuration Section -->
            <section class="mb-12">
                <h2 class="section-title text-3xl font-bold text-gray-800">高级配置</h2>

                <!-- Advanced Features -->
                <div class="grid md:grid-cols-2 gap-6 mt-8">
                    <!-- Dynamic ACL -->
                    <div class="bg-gradient-to-br from-purple-50 to-pink-50 rounded-2xl shadow-lg p-6 card-hover">
                        <div class="feature-icon">
                            <i class="fas fa-code-branch"></i>
                        </div>
                        <h3 class="text-xl font-bold text-gray-800 mb-3">1. 动态 ACL 配置</h3>
                        <p class="text-gray-600 mb-4">使用 Nginx 变量和 geo 模块实现灵活的访问控制</p>
                        <div class="code-block">
                            <div class="code-header">
                                <span>nginx.conf</span>
                                <button class="copy-btn" onclick="copyCode(this)">
                                    <i class="fas fa-copy mr-1"></i>复制
                                </button>
                            </div>
                            <pre><code>geo $block_ip {
    default 0;
    192.168.1.1 1;
    10.0.0.0/8 1;
}

server {
    listen 80;
    server_name demo.com;

    location / {
        if ($block_ip) {
            return 403;